CVE-2026-18560
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before othe
CVSS
4.3
Média
EPSS
0.2%
p8
KEV
—
Exploit Today
2
0-100
Publicado: 16 de out. de 2026 · Última mod.: 29 de out. de 2026 · CWE-203
0.2%EPSS · 30 dias0.2%
2026-10-162026-11-06
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-191346.5 MÉD22.7%
——7A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.
This issue affects OpenText Directory Services (OTDS): from 22.1 to 26.220hCVE-2026-1030215.3 MÉD28.2%
——8OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.20hCVE-2026-121223—8.2%
——2Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)4dCVE-2026-1211875.3 MÉD21.6%
——6Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2026-1211386.5 MÉD16.1%
——5Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)2dCVE-2026-1211305.3 MÉD19.1%
——6Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)2d